CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
An unauthenticated attacker can revoke victim sessions by submitting forged tokens to the Guardian.revoke/3 function, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55735?
CVE-2026-55735 is a high-severity vulnerability in ueberauth guardian, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token.
Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.
An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.
This issue affects guardian: from 1.0.0 before 2.4.1.
Weakness: CWE-347
Which versions are affected by CVE-2026-55735?
1 open source package ship an affected version, including guardian. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
guardian Hex | From 1.0.0 | 2.4.1 |
Products include Ueberauth Guardian.
How do I fix CVE-2026-55735?
Upgrade guardian to 2.4.1 or later.
Is CVE-2026-55735 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55735 exists.
Other vulnerabilities in ueberauth guardian
- CVE-2026-54894 Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
- CVE-2026-55733 Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
- CVE-2026-55734 guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
Sources
Also known as EEF-CVE-2026-55735, GHSA-7975-hp3r-5qhv.